@coventia/softphone 0.5.0 → 0.5.1

package/dist/chunk-3UTUWGVG.js

@@ -0,0 +1,1891 @@
+import { normalizeApiBase } from './chunk-M76SAXXM.js';
+import { createError, isSoftphoneError } from './chunk-FRXHEHQA.js';
+import { toDigits } from './chunk-DZRSSZWB.js';
+import { cachedTokenSource, invalidateToken } from './chunk-MHOJHG5E.js';
+
+// src/transports/sip/media.ts
+function buildAudioConstraints(deviceId) {
+  return { audio: deviceId ? { deviceId: { exact: deviceId } } : true, video: false };
+}
+function capIceGathering(session, capMs) {
+  let settled = false;
+  let timer;
+  const settle = (ready) => {
+    if (settled) return;
+    settled = true;
+    if (timer) clearTimeout(timer);
+    try {
+      ready();
+    } catch {
+    }
+  };
+  session.on("icecandidate", ({ ready }) => {
+    if (!timer) timer = setTimeout(() => settle(ready), capMs);
+  });
+  return () => {
+    if (timer) clearTimeout(timer);
+  };
+}
+
+// src/transports/sip/ice.ts
+var DEFAULT_ICE_SERVERS = [
+  { urls: "stun:stun.l.google.com:19302" }
+];
+var PC_CONFIG = { iceServers: [...DEFAULT_ICE_SERVERS] };
+
+// src/transports/sip/session.ts
+function mapEndReason(e) {
+  if (e.originator === "local") return "local";
+  if (e.originator === "remote") return "remote";
+  return "failed";
+}
+function mapFailReason(e) {
+  switch (e.cause) {
+    // 486 Busy Here, 600 Busy Everywhere. Also what most endpoints send for a MANUAL DECLINE — SIP
+    // does not distinguish the two, and neither can we, which is why the copy covers both.
+    case "Busy":
+      return "busy";
+    /*
+          `Rejected` is 403 / 603 Decline — an explicit refusal, sent by the endpoints that bother to.
+          `Redirected` is 3xx: not literally a rejection, but it ends the same way — not connected, and
+          nothing to retry.
+    
+          (Both comments sit ABOVE the group rather than between the labels. A comment between two `case`
+          lines makes the first one non-empty to `no-fallthrough`, which then demands a `break` that
+          would be unreachable.)
+        */
+    case "Rejected":
+    case "Redirected":
+      return "rejected";
+    /*
+      `Unavailable` is 480 Temporarily Unavailable / 410 / 408 Request Timeout / 430 — THE ring-out
+      case, and the one that was missing. `No Answer` and `Expires` are local: our own no-answer
+      timer, and a session that expired.
+    */
+    case "Unavailable":
+    case "No Answer":
+    case "Expires":
+      return "no-answer";
+    case "Canceled":
+      return e.originator === "local" ? "local" : "remote";
+    // Everything else is a genuine failure worth naming: Not Found (404/604), Address Incomplete,
+    // Incompatible SDP, Authentication Error, WebRTC Error, RTP Timeout, Connection Error…
+    default:
+      return "failed";
+  }
+}
+function remoteNumberOf(session) {
+  const id = session.remote_identity;
+  return id?.uri?.user ?? id?.uri?.toString() ?? "";
+}
+var SipEngineCall = class {
+  id;
+  direction;
+  remoteNumber;
+  #session;
+  #deps;
+  #listeners = /* @__PURE__ */ new Set();
+  #ended = false;
+  #cancelIceCap = null;
+  /**
+   * The stream behind a LIVE device swap (`swapInputDevice`), if one has happened. Distinct from
+   * JsSIP's own original capture: that one is `_localMediaStreamLocallyGenerated` and JsSIP stops it
+   * itself on close (see `#end`'s comment). This one is ours — obtained with our own `getUserMedia`
+   * call, attached via `replaceTrack`, and never known to JsSIP at all — so nothing else will ever
+   * stop it unless we do, here.
+   */
+  #swappedStream = null;
+  constructor(session, deps) {
+    this.#session = session;
+    this.#deps = deps;
+    this.id = deps.id;
+    this.direction = session.direction === "incoming" ? "inbound" : "outbound";
+    this.remoteNumber = remoteNumberOf(session);
+    this.#wire();
+  }
+  /** @internal — the underlying session, for `completeTransfer`'s REFER…Replaces. */
+  get session() {
+    return this.#session;
+  }
+  onEvent(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  // ── JsSIP events → raw engine signals ─────────────────────────────────────
+  #wire() {
+    const s = this.#session;
+    if (this.direction === "outbound") {
+      s.on("progress", () => this.#fire({ type: "progress", response: "ringing" }));
+    }
+    const wireRemoteTrack = (pc) => {
+      pc.ontrack = ({ streams }) => {
+        if (streams[0]) this.#fire({ type: "stream", stream: streams[0] });
+      };
+    };
+    s.on("peerconnection", ({ peerconnection }) => wireRemoteTrack(peerconnection));
+    if (s.connection) wireRemoteTrack(s.connection);
+    if (this.direction === "outbound" && this.#deps.iceGatheringCapMs) {
+      this.#cancelIceCap = capIceGathering(s, this.#deps.iceGatheringCapMs);
+    }
+    s.on("accepted", () => this.#onAccepted());
+    s.on("ended", (e) => this.#end(mapEndReason(e), e.cause));
+    s.on("failed", (e) => this.#end(mapFailReason(e), e.cause));
+    s.on("hold", ({ originator }) => this.#fire({ type: "held", originator }));
+    s.on("unhold", ({ originator }) => this.#fire({ type: "unheld", originator }));
+  }
+  /**
+   * The call is live. Nothing to swap: JsSIP opened the real microphone when the session was created,
+   * so the far end has had our actual audio from the first packet.
+   *
+   * There used to be a silent-mic dance here — place the call with a synthetic AudioContext track,
+   * swap the real mic in on accept — so a Bluetooth headset stayed in A2DP while the phone rang. It
+   * cost more than it bought: with no active capture, Firefox restricts ICE gathering and the offer
+   * goes out with no candidates at all, which no STUN or TURN server can fix.
+   */
+  #onAccepted() {
+    this.#fire({ type: "accepted" });
+  }
+  // ── Commands ───────────────────────────────────────────────────────────────
+  async answer() {
+    const deviceId = this.#deps.getInputDeviceId?.() ?? null;
+    this.#session.answer({
+      mediaConstraints: buildAudioConstraints(deviceId),
+      pcConfig: this.#deps.pcConfig ?? PC_CONFIG
+    });
+  }
+  /**
+   * Live-swap the outgoing microphone track — `CallEngine.setInputDevice` on a call that is already
+   * connected. Never touches the FIRST call's capture: that one is JsSIP's own `getUserMedia`, opened
+   * inside `answer()`/`ua.call()` (see `#onAccepted`'s comment on why that stays that way). This is
+   * only for a device chosen AFTER the call is already live.
+   *
+   * `RTCRtpSender.replaceTrack` rather than a fresh `answer()`/re-INVITE: it needs no SDP
+   * renegotiation and the far end never sees an interruption — exactly the mechanism real softphones
+   * use for "switch mic mid-call."
+   */
+  async swapInputDevice(deviceId) {
+    const pc = this.#session.connection;
+    if (!pc || this.#ended) return;
+    const sender = pc.getSenders().find((s) => s.track?.kind === "audio");
+    if (!sender) return;
+    let stream;
+    try {
+      stream = await navigator.mediaDevices.getUserMedia(buildAudioConstraints(deviceId));
+    } catch {
+      return;
+    }
+    if (this.#ended) {
+      for (const track2 of stream.getTracks()) track2.stop();
+      return;
+    }
+    const [track] = stream.getAudioTracks();
+    if (!track) return;
+    await sender.replaceTrack(track);
+    for (const oldTrack of this.#swappedStream?.getTracks() ?? []) oldTrack.stop();
+    this.#swappedStream = stream;
+  }
+  async reject() {
+    this.#deps.onReject?.();
+    this.#session.terminate({ status_code: 486, reason_phrase: "Busy Here" });
+  }
+  async hangup() {
+    this.#session.terminate();
+  }
+  mute(muted) {
+    if (muted) this.#session.mute({ audio: true });
+    else this.#session.unmute({ audio: true });
+  }
+  async hold() {
+    this.#session.hold();
+  }
+  async unhold() {
+    this.#session.unhold();
+  }
+  sendDigits(digits) {
+    this.#session.sendDTMF(digits);
+  }
+  async transfer(target) {
+    this.#session.refer(this.#deps.buildTarget(target));
+  }
+  async startConsult(target) {
+    return this.#deps.placeConsult(target);
+  }
+  async completeTransfer(consult) {
+    const consultSession = consult.session;
+    this.#session.refer(consultSession.remote_identity.uri.toString(), { replaces: consultSession });
+  }
+  // ── internals ──────────────────────────────────────────────────────────────
+  #end(reason, cause) {
+    if (this.#ended) return;
+    this.#ended = true;
+    this.#cancelIceCap?.();
+    for (const track of this.#swappedStream?.getTracks() ?? []) track.stop();
+    this.#swappedStream = null;
+    this.#fire({ type: "ended", reason, cause });
+    this.#listeners.clear();
+  }
+  #fire(event) {
+    if (this.#ended && event.type !== "ended") return;
+    for (const listener of [...this.#listeners]) listener(event);
+  }
+};
+
+// src/transports/sip/ua.ts
+var DEFAULT_ICE_CAP_MS = 3e3;
+var REGISTER_EXPIRES = 580;
+var ERROR_DEBOUNCE_MS = 3e4;
+var OFFER_FORGOTTEN_MS = 12e4;
+var DECLINE_GUARD_CEILING_MS = 12e4;
+var OFFER_PUSH_SLACK_MS = 1e4;
+var INVITE_TRANSACTION_MAX_MS = 32e3;
+var ICT_PROCEEDING = 2;
+var ICT_CALLING = 3;
+function inviteTransactionOf(session) {
+  const tx = session._request?.transaction;
+  return tx && typeof tx.state === "number" && typeof tx.on === "function" ? tx : null;
+}
+function awaitsAnswer(tx) {
+  return tx.state === ICT_CALLING || tx.state === ICT_PROCEEDING;
+}
+function deferredCancelOf(session) {
+  const flag = session._is_canceled;
+  return typeof flag === "boolean" ? flag : null;
+}
+var SUFFIX_MATCH_MIN_DIGITS = 9;
+function sameNumber(a, b) {
+  if (!a || !b) return false;
+  if (a === b) return true;
+  const [shorter, longer] = a.length < b.length ? [a, b] : [b, a];
+  return shorter.length >= SUFFIX_MATCH_MIN_DIGITS && longer.endsWith(shorter);
+}
+function isRefusal(e) {
+  const status = e?.response?.status_code;
+  if (typeof status === "number") return status === 401 || status === 403;
+  return e?.cause === "Authentication Error" || e?.cause === "Rejected";
+}
+function debug(message) {
+  console.debug(`[softphone] ${message}`);
+}
+var CALL_END_CODES = {
+  busy: "call/busy",
+  "no-answer": "call/no-answer",
+  rejected: "call/rejected",
+  failed: "call/failed"
+};
+function domainOf(credentials) {
+  const at = credentials.uri.lastIndexOf("@");
+  return at === -1 ? "" : credentials.uri.slice(at + 1);
+}
+var callSeq = 0;
+var nextCallId = () => `sip-${++callSeq}`;
+var SipCallEngine = class {
+  constructor(provider, factory, options = {}) {
+    this.provider = provider;
+    this.factory = factory;
+    this.now = options.now ?? Date.now;
+  }
+  provider;
+  factory;
+  #state = "stopped";
+  /**
+   * Which `start()`…`stop()` cycle this is — bumped by `stop()`, which ends one. Everything that awaits
+   * and then acts (builds a UA, subscribes to the signal, sets the state) captures it first and gives up
+   * if a stop has happened since. Not bumped by `start()`: that would cancel work begun just before it,
+   * such as a call placed while the softphone is still starting.
+   *
+   * Without it a stopped phone came back to life: a provisioning or a signal connect still in flight
+   * when `stop()` ran finished afterwards and REGISTERed — and since the PBX routes a call to whichever
+   * client registered last, it quietly took calls from the user's other device while its UI said off.
+   */
+  #run = 0;
+  #ua = null;
+  /** In-flight `#createUA()`. THE concurrency guard — see `#ensureUA`. */
+  #uaInFlight = null;
+  /**
+   * Bumped by every `#teardownUA`. A UA still being provisioned when its reason to exist went away — the offer
+   * ended, the leak guard gave up — is then not built (`#createUA`): built anyway, it would REGISTER for nobody
+   * and nothing would ever tear it down.
+   */
+  #uaEpoch = 0;
+  /**
+   * Dials waiting for the current UA to register (`#callWhenRegistered`): dialled by its `registered`, failed by
+   * `#teardownUA` — but kept when the UA is only being rebuilt on fresh credentials (`#retryOnFreshCredentials`).
+   */
+  #awaitingRegistration = /* @__PURE__ */ new Set();
+  /** `placeCall`s in progress, from before their UA exists: no offer's teardown may pull it from under them. */
+  #dialing = 0;
+  /**
+   * Where the current UA's registration stands: `connecting` (its REGISTER goes out once the WSS is up),
+   * `registering` (a REGISTER is out, unanswered), `registered` (the WSS is up and no REGISTER of ours is out — a
+   * refresh that failed under a live call leaves it here too). What decides how an offer gets a REGISTER sent
+   * after it (`#registerAfterOffer`).
+   */
+  #registration = "connecting";
+  /** An offer arrived while a REGISTER sent BEFORE it was still unanswered: another goes out once it is. */
+  #registerAgain = false;
+  /** A UA has already been rebuilt on fresh credentials since the last registration that worked: not again. */
+  #freshCredentialsTried = false;
+  #domain = "";
+  #activeCall = null;
+  /**
+   * The consult leg from `startConsult` (SPEC §5.6), if one is live on this UA right now.
+   *
+   * Tracked separately from `#activeCall` so `#maybeTeardownUA` can tell "both legs are actually gone"
+   * apart from "the main leg ended, but a consult is still up" — see that method's own comment for the
+   * bug this exists to prevent.
+   */
+  #consultCall = null;
+  /** The chosen microphone, or `null` for the browser default. Read fresh by every new leg's
+   *  `mediaConstraints`, and pushed live to `#activeCall` by `setInputDevice`. */
+  #inputDeviceId = null;
+  #incomingListeners = /* @__PURE__ */ new Set();
+  #stateListeners = /* @__PURE__ */ new Set();
+  #errorListeners = /* @__PURE__ */ new Set();
+  #signalUnsub = null;
+  #signalConnectionUnsub = null;
+  /** The offer waiting for its INVITE, if any (§4.3). */
+  #offerWait = null;
+  /**
+   * The latest offer pushed while a call was in progress. It used to be dropped for good — the caller then waited
+   * for the provider to offer it again. Now, when the call ends, it is registered for at once if it is still
+   * within its wait (no `offer-ended` for it, inside the leak guard), so it rings as soon as the line is free.
+   */
+  #pendingOffer = null;
+  /** Armed at the REGISTER's 200 OK while an offer waits (`noInviteAfterRegisterMs`). */
+  #noInviteTimer;
+  /**
+   * What the backend has said about the calls offered to this line (`noteOffer`, §5), by `callId` — ended ones
+   * included, for a while. Only for telling, at a decline, which call was declined and whether it is still alive.
+   */
+  #offers = /* @__PURE__ */ new Map();
+  /** Declined calls whose re-offers are being ignored (§4.4). Pruned as they lapse. */
+  #declined = [];
+  /** CANCELs JsSIP still owes for outbound legs that ended before any ringback (§4.7, `#watchOwedCancel`). */
+  #owedCancels = [];
+  /** UAs let go of while owing one: un-REGISTERed, still connected — with the cap that stops them regardless. */
+  #lingering = /* @__PURE__ */ new Map();
+  #errorSentAfter = /* @__PURE__ */ new Map();
+  now;
+  #resolvedFactory = null;
+  /** The loader in flight, shared: the pre-load at `start()` and a first UA racing it fetch the module once. */
+  #factoryLoad = null;
+  async #resolveFactory() {
+    if (this.#resolvedFactory) return this.#resolvedFactory;
+    if (typeof this.factory !== "function") return this.#resolvedFactory = this.factory;
+    const loader = this.factory;
+    this.#factoryLoad ??= Promise.resolve().then(() => loader()).finally(() => {
+      this.#factoryLoad = null;
+    });
+    this.#resolvedFactory = await this.#factoryLoad;
+    return this.#resolvedFactory;
+  }
+  /**
+   * Fetch the SIP stack now, not on the first call. It is loaded lazily (`import('jssip')`, SSR-safe — SPEC §10.2),
+   * and that used to happen on the first UA: between the first push after a page load and its REGISTER, measured
+   * 33–109 ms on localhost and more on a slow network or a throttled tab. Fire-and-forget: a failure here only
+   * leaves the lazy path to try again when a UA is built (incoming-call-reliability.md §4.5).
+   */
+  #preloadFactory() {
+    this.#resolveFactory().catch(() => {
+    });
+  }
+  get state() {
+    return this.#state;
+  }
+  onIncoming(listener) {
+    this.#incomingListeners.add(listener);
+    return () => this.#incomingListeners.delete(listener);
+  }
+  onStateChange(listener) {
+    this.#stateListeners.add(listener);
+    return () => this.#stateListeners.delete(listener);
+  }
+  onError(listener) {
+    this.#errorListeners.add(listener);
+    return () => this.#errorListeners.delete(listener);
+  }
+  /**
+   * Switch the microphone: stored for every FUTURE leg's `mediaConstraints`, and — if a call is live
+   * right now — pushed to it immediately via `SipEngineCall.swapInputDevice` (SPEC §7 Phase 2, device
+   * management). `null` resets to the browser's own default device.
+   */
+  async setInputDevice(deviceId) {
+    this.#inputDeviceId = deviceId;
+    await this.#activeCall?.swapInputDevice(deviceId);
+  }
+  /**
+   * Report a failure, at most once per code per `ERROR_DEBOUNCE_MS`.
+   *
+   * A failing registrar retries, and one emission per attempt would flood a host's logging and make
+   * whatever the widget shows flicker. Debounced per CODE rather than globally, so a transport
+   * failure is never swallowed because a registration failure happened to precede it.
+   */
+  #reportError(code, cause) {
+    this.#emitError(createError(code, cause));
+  }
+  /**
+   * Emit, debouncing FATAL codes only.
+   *
+   * A failing registrar retries, and one emission per attempt would flood a host's logging and make
+   * whatever the widget shows flicker — so the same fatal code is reported at most once per window,
+   * per CODE, so a transport failure is never swallowed because a registration failure preceded it.
+   *
+   * Non-fatal codes are never debounced: they describe one call each, and two busy tones in a row are
+   * two facts, not a repeated one.
+   */
+  #emitError(error) {
+    if (error.fatal) {
+      const now = this.now();
+      if (now < (this.#errorSentAfter.get(error.code) ?? 0)) return;
+      this.#errorSentAfter.set(error.code, now + ERROR_DEBOUNCE_MS);
+    }
+    for (const listener of [...this.#errorListeners]) listener(error);
+  }
+  async start() {
+    const run = this.#run;
+    this.#setState("starting");
+    if (this.provider.registrationMode === "persistent") {
+      try {
+        await this.#ensureUA();
+      } catch (cause) {
+        if (run === this.#run) throw cause;
+      }
+      if (run !== this.#run) return;
+      this.#setState("online");
+    } else {
+      this.#preloadFactory();
+      const signal = this.provider.incomingSignal;
+      if (signal) {
+        try {
+          await signal.connect();
+        } catch (cause) {
+          if (run !== this.#run) return;
+          signal.disconnect();
+          throw cause;
+        }
+        if (run !== this.#run) return;
+        this.#signalUnsub = signal.onSignal((event) => this.#onIncomingSignal(event));
+        this.#signalConnectionUnsub = signal.onConnectionChange?.(
+          (connected) => this.#setState(connected ? "online" : "offline")
+        ) ?? null;
+      }
+      this.#setState(signal?.onConnectionChange ? signal.connected ? "online" : "offline" : "online");
+    }
+  }
+  async stop() {
+    this.#run += 1;
+    this.#pendingOffer = null;
+    this.#clearNoInviteTimer();
+    this.#signalUnsub?.();
+    this.#signalUnsub = null;
+    this.#signalConnectionUnsub?.();
+    this.#signalConnectionUnsub = null;
+    this.provider.incomingSignal?.disconnect();
+    this.#teardownUA();
+    this.#setState("stopped");
+  }
+  async placeCall(destination, _options) {
+    this.#dialing += 1;
+    const run = this.#run;
+    try {
+      await this.#ensureUA();
+      return await this.#callWhenRegistered(this.#buildTarget(destination), run);
+    } finally {
+      this.#dialing -= 1;
+    }
+  }
+  /**
+   * What the backend says about calls offered to this line (incoming-call-reliability.md §5) — kept only to tell,
+   * at a decline, WHICH call was declined, and so how long its re-offers last (§4.4).
+   *
+   * Per `callId`, every message is idempotent, and they come duplicated, with no order at all — not even between
+   * the `start` and the `end` of one call, which reach different backend instances and are relayed through Redis,
+   * and a stored offer replayed after `hello` can race either. So `ended` is sticky: a `start` after its call's
+   * `end` never makes it live again. An `end` also reaches a softphone that is not the line's owner (a `start` only
+   * the owner): stored all the same, whatever state this engine is in. `null`: the channel went away, so no `end`
+   * can be counted on for the calls still live; a guard following one falls back to its window. What is known to
+   * have ended stays known.
+   */
+  noteOffer(offer) {
+    const now = this.now();
+    for (const [callId, known2] of this.#offers) {
+      if (now - known2.at >= OFFER_FORGOTTEN_MS) this.#offers.delete(callId);
+    }
+    if (offer === null) {
+      for (const [callId, known2] of this.#offers) if (known2.endedAt === null) this.#offers.delete(callId);
+      return;
+    }
+    const known = this.#offers.get(offer.callId);
+    this.#offers.delete(offer.callId);
+    const from = toDigits(offer.from ?? "") || (known?.from ?? "");
+    const fallbackMs = this.#declineFallbackMs();
+    if (offer.state === "end") {
+      this.#offers.set(offer.callId, { from, at: now, endedAt: known?.endedAt ?? now });
+      this.#declined = this.#declined.filter((declined) => declined.callId !== offer.callId);
+      if (from) {
+        this.#declined = this.#declined.map(
+          (declined) => declined.adopts && now >= declined.since && sameNumber(declined.caller, from) ? { ...declined, adopts: false } : declined
+        );
+      }
+      return;
+    }
+    const endedAt = known?.endedAt ?? null;
+    this.#offers.set(offer.callId, { from, at: now, endedAt });
+    if (!from) return;
+    if (endedAt !== null) {
+      const isThatCall = (declined) => declined.adopts && now - declined.at < fallbackMs && endedAt >= declined.since && sameNumber(declined.caller, from);
+      this.#declined = this.#declined.filter((declined) => !isThatCall(declined));
+      return;
+    }
+    this.#declined = this.#declined.map(
+      (declined) => declined.adopts && now - declined.at < fallbackMs && now <= declined.since + OFFER_PUSH_SLACK_MS && sameNumber(declined.caller, from) ? { ...declined, callId: offer.callId, adopts: false } : declined
+    );
+  }
+  // ── incoming (on-demand: push → register → INVITE) ────────────────────────
+  /**
+   * The push's own word on what it is (incoming-call-reliability.md §4.1, read by the provider): only an `offer`
+   * registers. Before this, every push did — `answered` after each hang-up included — and the UA it left
+   * registered is where the next call's INVITE never came (F2).
+   */
+  #onIncomingSignal(event) {
+    if (event.kind === "offer") void this.#onOffer(event.from);
+    else if (event.kind === "offer-ended") this.#onOfferEnded(event.from);
+    else debug(`push ignored: ${event.detail}`);
+  }
+  /** `pushedAt`: when its push came, for an offer kept while a call was in progress (`#pendingOffer`). */
+  async #onOffer(from, pushedAt = this.now()) {
+    if (this.#isDeclinedCaller(from)) {
+      debug("offer ignored: the caller just declined is being offered again");
+      return;
+    }
+    if (this.#activeCall) {
+      this.#pendingOffer = { from, at: pushedAt };
+      return;
+    }
+    this.#awaitOffer(from, pushedAt);
+    const ua = this.#ua;
+    if (ua) {
+      this.#registerAfterOffer(ua);
+      return;
+    }
+    const run = this.#run;
+    const epoch = this.#uaEpoch;
+    try {
+      await this.#ensureUA();
+    } catch {
+      if (run === this.#run && epoch === this.#uaEpoch) this.#teardownUA();
+    }
+  }
+  /**
+   * That offer is over — answered elsewhere, declined, cancelled, timed out (§4.1). A UA still waiting for its
+   * INVITE goes now instead of when a timer says so; never one carrying a call (`#maybeTeardownUA`). Only when the
+   * push names the same caller as the offer waited for: two offers can overlap, and an end that names nobody (a
+   * withheld number, a push with no `callerid`) could be anyone's — the timers bound that wait instead.
+   */
+  #onOfferEnded(from) {
+    const caller = toDigits(from ?? "");
+    if (!caller) return;
+    if (this.#pendingOffer && sameNumber(caller, toDigits(this.#pendingOffer.from ?? ""))) this.#pendingOffer = null;
+    const wait = this.#offerWait;
+    if (!wait || !sameNumber(caller, wait.from)) return;
+    this.#offerOver();
+  }
+  /**
+   * Starts waiting for this offer's INVITE: a leak guard from its push (§4.3), and no no-INVITE timer yet.
+   * `pushedAt` is now, except for an offer kept through a call (`#pendingOffer`).
+   */
+  #awaitOffer(from, pushedAt) {
+    this.#endOfferWait();
+    const ms = this.provider.quirks?.offerWaitMaxMs;
+    const leak = ms ? setTimeout(
+      () => {
+        if (this.#offerWait !== wait) return;
+        debug("offer abandoned: still no INVITE long after its push");
+        this.#offerOver();
+      },
+      Math.max(0, ms - (this.now() - pushedAt))
+    ) : void 0;
+    const wait = { from: toDigits(from ?? ""), at: pushedAt, leak };
+    this.#offerWait = wait;
+  }
+  /**
+   * The offer kept through the call that just ended, if it is still worth registering for: no `offer-ended` for
+   * it, and still inside the leak guard from its push. Taken: it is registered for once, at most.
+   */
+  #takePendingOffer() {
+    const pending = this.#pendingOffer;
+    this.#pendingOffer = null;
+    if (!pending || !this.#signalUnsub) return null;
+    const maxMs = this.provider.quirks?.offerWaitMaxMs;
+    if (maxMs && this.now() - pending.at >= maxMs) return null;
+    return pending;
+  }
+  /** No INVITE is coming for the offer being waited for: its UA goes, unless something else is on it. */
+  #offerOver() {
+    this.#endOfferWait();
+    this.#maybeTeardownUA();
+  }
+  #endOfferWait() {
+    if (this.#offerWait?.leak) clearTimeout(this.#offerWait.leak);
+    this.#offerWait = null;
+    this.#registerAgain = false;
+    this.#clearNoInviteTimer();
+  }
+  /**
+   * A REGISTER sent AFTER this offer's push, on the UA that is already there (§4.2). Whether one is needed depends
+   * on where that UA's registration stands:
+   *   - `connecting`: its REGISTER goes out when the WSS is up — after this push already.
+   *   - `registering`: the REGISTER in flight went out BEFORE this push; another follows its answer.
+   *   - `registered`: a refresh, now.
+   */
+  #registerAfterOffer(ua) {
+    if (this.#registration === "registering") this.#registerAgain = true;
+    else if (this.#registration === "registered") this.#refreshRegistration(ua);
+  }
+  /**
+   * A REGISTER refresh whose 200 OK is HEARD — the no-INVITE wait counts from it (§4.3).
+   *
+   * JsSIP's `register()` sends one, but announces `registered` only for a UA that was not registered
+   * (`Registrator.js`: `if (!this._registered)`), so a refresh's 200 OK would pass in silence.
+   * `registrator().onTransportClosed()` clears that flag and sends nothing — it is what JsSIP runs itself when its
+   * WSS drops, before registering again — so after it the refresh is announced like a first registration. On the
+   * wire nothing changes: the same refresh (same Call-ID, next CSeq) the lab saw answered with the INVITE
+   * (Q5). Only called with no REGISTER of ours in flight (`#registration`), so no answer is left orphaned.
+   *
+   * A JsSIP without that hook still sends the refresh; its 200 OK just cannot be heard, so the wait starts now.
+   */
+  #refreshRegistration(ua) {
+    const registrator = ua.registrator?.();
+    const heard = typeof registrator?.onTransportClosed === "function";
+    if (heard) registrator.onTransportClosed();
+    this.#registration = heard ? "registering" : "registered";
+    ua.register();
+    if (!heard && this.#offerWait) this.#armNoInviteTimer();
+  }
+  /**
+   * Armed at the REGISTER's 200 OK, never at `ua.start()`: on a slow network the WSS alone outlasted the old 5 s,
+   * and the UA was gone before it ever registered (F3). The INVITE follows the 200 OK by ~0.1 s (§2).
+   */
+  #armNoInviteTimer() {
+    this.#clearNoInviteTimer();
+    const ms = this.provider.quirks?.noInviteAfterRegisterMs;
+    if (!ms) return;
+    this.#noInviteTimer = setTimeout(() => {
+      this.#noInviteTimer = void 0;
+      this.#offerOver();
+    }, ms);
+  }
+  #clearNoInviteTimer() {
+    if (this.#noInviteTimer) clearTimeout(this.#noInviteTimer);
+    this.#noInviteTimer = void 0;
+  }
+  // ── the decline guard (SPEC §3.4, incoming-call-reliability.md §4.4) ───────
+  /**
+   * Whether an offer — or an INVITE — from this caller is a re-offer of a call just declined. The provider re-offers a
+   * declined call until its ring time ends, and nothing in a re-offer tells it from a new call. The guard used to
+   * swallow EVERY offer and INVITE for 35 s, whoever called: a new call in that window was lost (CWA-81, F1).
+   *
+   * Now it holds only for the declined caller, and only while that call lives: until the backend's `end` for it
+   * when it announced the call (`noteOffer`) — at most `DECLINE_GUARD_CEILING_MS` — else for the provider's
+   * fallback window after the decline. Anyone else always rings; so does a caller this cannot name.
+   */
+  #isDeclinedCaller(number) {
+    const fallbackMs = this.#declineFallbackMs();
+    if (!fallbackMs || this.#declined.length === 0) return false;
+    const now = this.now();
+    this.#declined = this.#declined.filter((declined) => {
+      const offer = declined.callId === null ? void 0 : this.#offers.get(declined.callId);
+      if (offer && offer.endedAt === null) return now - declined.at < DECLINE_GUARD_CEILING_MS;
+      return now - declined.at < fallbackMs;
+    });
+    const caller = toDigits(number ?? "");
+    return this.#declined.some((declined) => sameNumber(declined.caller, caller));
+  }
+  /** The decline guard's fallback window — and whether there is a guard at all: only a provider that re-offers. */
+  #declineFallbackMs() {
+    return this.provider.quirks?.declinedCallerGuardMs ?? 0;
+  }
+  /**
+   * The user declined `call`. Remembers the caller as its INVITE named them, and which offer the backend says that
+   * is (§4.4). Only what the backend said about THIS call counts: a call from the same caller that ended before
+   * this one was pushed (`since`) is another call — taking it for this one lost the callback after a second
+   * decline of the same caller.
+   *   - a live offer from that caller, announced around this call's push or after: the guard follows it until
+   *     its `end`;
+   *   - an offer from that caller that ENDED since this call's push (the first leg of a transfer, a ring-group
+   *     call someone else answered): the fallback window — whatever that caller sends next is not that call, so
+   *     no later `start` is taken for it;
+   *   - neither (its `start` lands after the decline): the fallback window, and a `start` from that caller that
+   *     comes around this call's push is taken as this call's (`noteOffer`).
+   *
+   * An INVITE that names nobody (a withheld number) guards nobody. It used to borrow the caller of the latest push,
+   * which with two offers overlapping is someone else's — and that someone's calls were then ignored.
+   */
+  #onDecline(call, since) {
+    if (!this.#declineFallbackMs() || call.direction !== "inbound") return;
+    const caller = toDigits(call.remoteNumber);
+    if (!caller) return;
+    const now = this.now();
+    let latest = null;
+    for (const [callId, offer] of this.#offers) {
+      if (!sameNumber(offer.from, caller) || now - offer.at >= OFFER_FORGOTTEN_MS) continue;
+      if (offer.endedAt === null && offer.at >= since - OFFER_PUSH_SLACK_MS) latest = { callId, ended: false };
+      else if (offer.endedAt !== null && offer.endedAt >= since) latest = { callId, ended: true };
+    }
+    this.#declined.push(
+      latest && !latest.ended ? { caller, callId: latest.callId, adopts: false, at: now, since } : { caller, callId: null, adopts: latest === null, at: now, since }
+    );
+  }
+  #onNewSession(session, originator) {
+    if (originator !== "remote") return;
+    if (this.#activeCall) {
+      session.terminate({ status_code: 486, reason_phrase: "Busy Here" });
+      return;
+    }
+    if (this.#isDeclinedCaller(remoteNumberOf(session))) {
+      debug("INVITE declined: the caller just declined is being offered again");
+      session.terminate({ status_code: 486, reason_phrase: "Busy Here" });
+      return;
+    }
+    const since = this.#offerWait?.at ?? this.now();
+    this.#endOfferWait();
+    const call = this.#wrapCall(session, since);
+    for (const listener of [...this.#incomingListeners]) listener(call);
+  }
+  // ── UA lifecycle ───────────────────────────────────────────────────────────
+  /**
+   * The single UA, created at most once — even under concurrent callers.
+   *
+   * **The `#ua` check alone is not a guard**, because everything after it awaits: two callers both
+   * see `null`, both `provision()`, both build a UA, and both REGISTER the same extension. Zadarma
+   * rejects the loser, `registrationFailed` tears down, and the survivor may be the one that was
+   * torn down. The visible symptom is two `get_webphone_data.php` calls at startup and a phone that
+   * never registers.
+   *
+   * Concurrency is the normal case here, not an edge: the push socket can offer twice in a heartbeat
+   * (a push seen on both sockets of a rebuild, two calls at once), and `placeCall` can land on top of
+   * one. So the in-flight promise IS the guard.
+   */
+  async #ensureUA() {
+    if (this.#ua) return this.#ua;
+    if (!this.#uaInFlight) {
+      const inFlight = this.#createUA().finally(() => {
+        if (this.#uaInFlight === inFlight) this.#uaInFlight = null;
+      });
+      this.#uaInFlight = inFlight;
+    }
+    return this.#uaInFlight;
+  }
+  async #createUA() {
+    const run = this.#run;
+    const epoch = this.#uaEpoch;
+    const factory = await this.#resolveFactory();
+    let credentials;
+    try {
+      credentials = await this.provider.provision();
+    } catch (cause) {
+      if (isSoftphoneError(cause)) this.#emitError(cause);
+      else this.#reportError("provider/provision-failed", cause);
+      throw cause;
+    }
+    if (run !== this.#run) throw createError("engine/not-started");
+    if (epoch !== this.#uaEpoch) throw createError("call/failed", "the UA was let go of before it was built");
+    this.#domain = domainOf(credentials);
+    const config = this.#uaConfig(credentials, factory);
+    const ua = factory.createUA(config);
+    let reached = false;
+    ua.on("newRTCSession", ({ session, originator }) => {
+      if (ua !== this.#ua) {
+        if (originator === "remote") session.terminate({ status_code: 486, reason_phrase: "Busy Here" });
+        return;
+      }
+      this.#onNewSession(session, originator);
+    });
+    ua.on("disconnected", ({ error }) => {
+      if (ua !== this.#ua) return;
+      this.#registration = "connecting";
+      if (!error) return;
+      if (!reached && this.#retryOnFreshCredentials("unreachable", ua, credentials)) return;
+      this.#setState("reconnecting");
+      this.#reportError("net/transport-failed", error);
+    });
+    ua.on("connected", () => {
+      if (ua !== this.#ua) return;
+      reached = true;
+      this.#registration = "registering";
+      this.#setState("online");
+    });
+    ua.on("registered", () => {
+      if (ua !== this.#ua) return;
+      this.#registration = "registered";
+      this.#freshCredentialsTried = false;
+      this.provider.credentialsWorked?.();
+      for (const waiter of [...this.#awaitingRegistration]) waiter.dial(ua);
+      if (this.#registerAgain) {
+        this.#registerAgain = false;
+        this.#refreshRegistration(ua);
+        return;
+      }
+      if (this.#offerWait) this.#armNoInviteTimer();
+    });
+    ua.on("registrationFailed", (e) => {
+      if (run !== this.#run) return;
+      const detail = e;
+      if (isRefusal(detail) && this.#retryOnFreshCredentials("rejected", ua, credentials)) return;
+      this.#reportError("net/registration-failed", {
+        cause: detail?.cause,
+        status: detail?.response?.status_code,
+        domain: this.#domain,
+        hint: "A bare 401 with no auth challenge usually means the registrar is in the wrong datacenter (SPEC \xA73.1)."
+      });
+      if (ua !== this.#ua) return;
+      if (this.#carriesCall()) {
+        for (const waiter of [...this.#awaitingRegistration]) waiter.fail();
+        this.#registration = "registered";
+        const wait = this.#offerWait;
+        if (wait) {
+          this.#pendingOffer = { from: wait.from || null, at: wait.at };
+          this.#endOfferWait();
+        }
+        return;
+      }
+      this.#teardownUA();
+    });
+    this.#ua = ua;
+    this.#registration = "connecting";
+    ua.start();
+    return ua;
+  }
+  /**
+   * The credentials behind `ua` did not work. The provider hears it either way, with the credentials in question
+   * (it forgets them unless it has moved on from them already; a provider whose signal shares them renews that
+   * too); then, if it has new ones to give, the current UA is rebuilt on them — once until a registration works,
+   * and never under a live call. Whoever waited on the old UA — an offer, a dial — waits on the new one. Returns
+   * whether it was rebuilt.
+   *
+   * This replaces the engine's old `#refreshSignal` (a close-then-reopen of the push socket after ANY failed
+   * registration): only the provider knows what its credentials and its signal share.
+   */
+  #retryOnFreshCredentials(reason, ua, credentials) {
+    const fresh = this.provider.credentialsFailed?.(reason, credentials) ?? false;
+    if (!fresh || ua !== this.#ua || this.#freshCredentialsTried) return false;
+    if (this.#carriesCall()) return false;
+    this.#freshCredentialsTried = true;
+    const run = this.#run;
+    this.#teardownUA({ replacing: true });
+    const epoch = this.#uaEpoch;
+    void this.#ensureUA().catch(() => {
+      if (run === this.#run && epoch === this.#uaEpoch) this.#teardownUA();
+    });
+    return true;
+  }
+  #uaConfig(credentials, factory) {
+    return {
+      sockets: [factory.createWebSocket(credentials.wsUrl)],
+      uri: credentials.uri,
+      authorization_user: credentials.authUser,
+      password: credentials.password,
+      register: true,
+      register_expires: REGISTER_EXPIRES,
+      connection_recovery_min_interval: 2,
+      connection_recovery_max_interval: 30,
+      // Generic — NOT a provider brand string. If a provider ever requires a specific UA header it
+      // belongs in the provider, not hard-coded here.
+      // NOT ours to choose: Zadarma refuses to register any client whose User-Agent it does not
+      // recognise (see ProviderQuirks.userAgent). The provider decides; the engine just sends it.
+      user_agent: this.provider.quirks?.userAgent ?? "Coventia Softphone"
+    };
+  }
+  /**
+   * Lets the current UA go — and one still being provisioned (`#uaEpoch`). `replacing`: a successor is being
+   * built on fresh credentials right away (`#retryOnFreshCredentials`), so the dials and the offer waiting on
+   * this one carry over to it instead of ending here.
+   */
+  #teardownUA({ replacing = false } = {}) {
+    this.#uaEpoch += 1;
+    this.#uaInFlight = null;
+    this.#registration = "connecting";
+    this.#registerAgain = false;
+    if (!replacing) {
+      for (const waiter of [...this.#awaitingRegistration]) waiter.fail();
+      this.#endOfferWait();
+    }
+    if (!this.#ua) return;
+    const ua = this.#ua;
+    this.#ua = null;
+    this.#activeCall = null;
+    this.#consultCall = null;
+    try {
+      ua.terminateSessions({ status_code: 487 });
+    } catch {
+    }
+    if (this.#owedCancels.some((owed) => owed.ua === ua)) {
+      this.#linger(ua);
+      return;
+    }
+    try {
+      ua.stop();
+    } catch {
+    }
+  }
+  // ── the CANCEL a hang-up still owes (incoming-call-reliability.md §4.7, F6) ─────────────────────────────
+  /**
+   * Watches an outbound leg — a call or a consult leg — from its creation, for the CANCEL JsSIP may end up owing.
+   *
+   * JsSIP's `terminate()` between sending the INVITE and the first provisional response cannot cancel yet (RFC 3261
+   * §9.1): it marks the session canceled, fails it locally with `Canceled`, and sends the CANCEL when a 1xx comes —
+   * or ACKs and BYEs a late 2xx. Live, that 1xx came 17 s late, the engine had torn the UA down on the call's end, and
+   * the callee's phone rang on for a caller who was gone: a ghost call. Hence: the INVITE went out (`sending`), no
+   * provisional above 100 came (`progress`), and it failed locally `Canceled` → the CANCEL is owed, on this UA.
+   *
+   * Registered BEFORE the leg's own listeners: its `failed` must be on record before the leg's end tears the UA down.
+   */
+  #watchOwedCancel(session, ua) {
+    let sent = false;
+    let ringing = false;
+    session.on("sending", () => sent = true);
+    session.on("progress", () => ringing = true);
+    session.on("failed", ({ originator, cause }) => {
+      if (!sent || originator !== "local" || cause !== "Canceled") return;
+      const tx = inviteTransactionOf(session);
+      const owes = deferredCancelOf(session) ?? (tx ? tx.state === ICT_CALLING : !ringing);
+      if (!owes || tx && !awaitsAnswer(tx)) return;
+      const owed = { ua, session, tx };
+      this.#owedCancels.push(owed);
+      if (tx) this.#followInvite(owed, tx);
+    });
+  }
+  /**
+   * Follows the INVITE an owed CANCEL is waiting on, until it is over. Not just the first one: Zadarma challenges every
+   * INVITE (407), and JsSIP re-sends it with credentials on a NEW transaction — canceled leg or not — in the same tick
+   * that completes the first. Releasing on that first transaction stopped the UA two seconds later, and the re-sent
+   * INVITE's 1xx landed nowhere: the ghost call again (found driving the real JsSIP). So once one is over, the leg's
+   * current transaction is read again a moment later, and followed while it still waits for an answer.
+   */
+  #followInvite(owed, tx) {
+    const settle = () => {
+      if (awaitsAnswer(tx)) return;
+      tx.removeListener?.("stateChanged", settle);
+      queueMicrotask(() => {
+        const latest = inviteTransactionOf(owed.session);
+        if (latest && latest !== tx && awaitsAnswer(latest)) {
+          owed.tx = latest;
+          this.#followInvite(owed, latest);
+          return;
+        }
+        this.#owedCancels = this.#owedCancels.filter((other) => other !== owed);
+        this.#releaseIfSettled(owed.ua);
+      });
+    };
+    tx.on("stateChanged", settle);
+  }
+  /**
+   * Lets `ua` go while it owes a CANCEL: un-REGISTERed at once, as any teardown, but connected until every INVITE it
+   * owes is over — COMPLETED (a final non-2xx: the 487 after the late 1xx's CANCEL), ACCEPTED (a late 2xx, which
+   * JsSIP ACKs and BYEs) or TERMINATED (Timer B, a transport error) — and never longer than Timer B. Detached: the
+   * engine has already moved on (a push or a dial builds a fresh UA), so no timer of its own, no teardown and no
+   * "is a call on it" ever sees this one, and an INVITE reaching it is declined like any let-go UA's.
+   */
+  #linger(ua) {
+    if (this.#lingering.has(ua)) return;
+    this.#lingering.set(ua, setTimeout(() => this.#release(ua), INVITE_TRANSACTION_MAX_MS));
+    ua.on("registered", () => {
+      if (this.#lingering.has(ua)) this.#unregister(ua);
+    });
+    this.#unregister(ua);
+    this.#releaseIfSettled(ua);
+  }
+  #unregister(ua) {
+    try {
+      ua.unregister();
+    } catch {
+    }
+  }
+  /**
+   * Once nothing is owed on a lingering UA, it stops — on the next tick: a late 2xx is ACKed and BYEd in the very
+   * tick that settled it, and JsSIP's own `stop()` then keeps the transport ≤ 2 s for that BYE's answer.
+   */
+  #releaseIfSettled(ua) {
+    if (!this.#lingering.has(ua) || this.#owedCancels.some((owed) => owed.ua === ua)) return;
+    setTimeout(() => this.#release(ua), 0);
+  }
+  #release(ua) {
+    const cap = this.#lingering.get(ua);
+    if (cap === void 0) return;
+    clearTimeout(cap);
+    this.#lingering.delete(ua);
+    this.#owedCancels = this.#owedCancels.filter((owed) => owed.ua !== ua);
+    try {
+      ua.stop();
+    } catch {
+    }
+  }
+  /**
+   * Place a call once the current UA is registered (its 200 OK for REGISTER has arrived).
+   *
+   * **No `mediaStream`** — JsSIP calls `getUserMedia` itself, which is what opens a real capture.
+   *
+   * That is load-bearing, not incidental. Firefox restricts ICE gathering on a page with no active
+   * capture: it discards every address but the default route's ("Ignoring addr from interface other
+   * than …" in about:webrtc) and can end up gathering NOTHING, so the INVITE goes out with
+   * `c=IN IP4 0.0.0.0` and no candidates at all. No STUN or TURN server can rescue an offer that
+   * contains no candidates. The legacy hook passed `mediaConstraints` and nothing else, for what
+   * turns out to be a very good reason.
+   */
+  #callWhenRegistered(target, run) {
+    const options = { mediaConstraints: buildAudioConstraints(this.#inputDeviceId), pcConfig: PC_CONFIG };
+    const refusal = () => createError(run === this.#run ? "call/failed" : "engine/not-started");
+    const dial = (registered) => {
+      const session = registered.call(target, options);
+      this.#watchOwedCancel(session, registered);
+      return this.#wrapCall(session);
+    };
+    const ua = this.#ua;
+    if (!ua || run !== this.#run) return Promise.reject(refusal());
+    if (ua.isRegistered()) return Promise.resolve(dial(ua));
+    return new Promise((resolve, reject) => {
+      const waiter = {
+        dial: (registered) => {
+          this.#awaitingRegistration.delete(waiter);
+          try {
+            resolve(dial(registered));
+          } catch (cause) {
+            reject(cause);
+          }
+        },
+        fail: () => {
+          this.#awaitingRegistration.delete(waiter);
+          reject(refusal());
+        }
+      };
+      this.#awaitingRegistration.add(waiter);
+    });
+  }
+  /**
+   * `since`, for an inbound call: when its push came (its INVITE, when none was seen) — what `#onDecline` needs to
+   * tell this call from the caller's others.
+   */
+  #wrapCall(session, since = this.now()) {
+    const call = new SipEngineCall(session, {
+      id: nextCallId(),
+      buildTarget: (t) => this.#buildTarget(t),
+      placeConsult: (t) => this.#placeConsult(t),
+      // The guard is tied to the reject ACTION, not to `ended` — a normal hangup must not arm it.
+      onReject: () => this.#onDecline(call, since),
+      iceGatheringCapMs: this.provider.quirks?.iceGatheringCapMs ?? DEFAULT_ICE_CAP_MS,
+      // Inbound answers open their own peer connection, so they need the same ICE servers the
+      // outbound leg got. Missing here, an ANSWERED call is the one that fails — the half nobody
+      // tests until a real person picks up.
+      pcConfig: PC_CONFIG,
+      // Read fresh at answer() time, not captured now — a device chosen while the phone is still
+      // ringing must still apply once it is picked up.
+      getInputDeviceId: () => this.#inputDeviceId
+    });
+    this.#activeCall = call;
+    call.onEvent((event) => {
+      if (event.type === "ended") {
+        const missed = call.direction === "inbound" && event.cause === "Canceled";
+        const code = missed ? "call/missed" : CALL_END_CODES[event.reason];
+        if (code) this.#reportError(code, event.cause);
+        if (this.#activeCall === call) this.#activeCall = null;
+        this.#legEnded();
+      }
+    });
+    return call;
+  }
+  /**
+   * A leg ended. The UA goes if nothing is left on it (`#maybeTeardownUA`); and once no leg at all is left, an
+   * offer kept through the call (`#pendingOffer`, §4.3) gets its REGISTER — the line is free now.
+   */
+  #legEnded() {
+    const pending = this.#activeCall || this.#consultCall ? null : this.#takePendingOffer();
+    this.#maybeTeardownUA();
+    if (pending) void this.#onOffer(pending.from, pending.at);
+  }
+  async #placeConsult(target) {
+    const ua = await this.#ensureUA();
+    const consultSession = ua.call(this.#buildTarget(target), {
+      mediaConstraints: buildAudioConstraints(this.#inputDeviceId),
+      pcConfig: PC_CONFIG
+    });
+    this.#watchOwedCancel(consultSession, ua);
+    const consultCall = new SipEngineCall(consultSession, {
+      id: nextCallId(),
+      buildTarget: (x) => this.#buildTarget(x),
+      placeConsult: () => Promise.reject(new Error("cannot consult from a consult leg")),
+      iceGatheringCapMs: this.provider.quirks?.iceGatheringCapMs ?? DEFAULT_ICE_CAP_MS
+    });
+    this.#consultCall = consultCall;
+    consultCall.onEvent((event) => {
+      if (event.type === "ended") {
+        if (this.#consultCall === consultCall) this.#consultCall = null;
+        this.#legEnded();
+      }
+    });
+    return consultCall;
+  }
+  /**
+   * On-demand registration (SPEC §3.3): the UA is disposable once NOTHING is left on it — but "the
+   * main leg ended" (or "no INVITE followed this push") is not the same fact as "nothing is left."
+   * `completeTransfer()` (SPEC §5.6) ends the main leg via a REFER…Replaces BYE *while the consult leg
+   * is still what the PBX needs to bridge the caller onto* — tearing the UA down (and with it, EVERY
+   * session on it, via `terminateSessions`) the instant the main leg's `ended` fires killed that
+   * consult leg out from under the transfer before the bridge could use it, and the caller was simply
+   * gone. Two real call sites hit this independently (found live, 2026-08-04): the main leg's own
+   * `ended` handler, and the no-INVITE timer — which then re-armed on EVERY push, including the
+   * `answered` pushes Zadarma sends around other account activity, so it could fire minutes after a
+   * transfer with no `#activeCall` and no idea a consult leg was mid-handoff. Every teardown an offer
+   * asks for (its timers, its `offer-ended`) routes through here rather than checking `#activeCall` alone.
+   *
+   * A dial on its way (`#dialing`) counts too: its UA may not even exist yet, and an offer ending must not
+   * take it. So does an offer still waiting for its INVITE: mid-transfer, with only the consult leg left, an
+   * offer registers on this UA — and the consult leg ending used to tear it down and drop that offer, its call
+   * ringing nowhere until the provider offered it again ~30 s later. The wait's own ending (its INVITE, its
+   * `offer-ended`, the no-INVITE timer, the leak guard) clears `#offerWait` before it calls this, so nothing keeps
+   * the UA past those (incoming-call-reliability.md §4.3).
+   */
+  #maybeTeardownUA() {
+    if (this.provider.registrationMode !== "on-demand") return;
+    if (this.#activeCall || this.#consultCall || this.#dialing > 0 || this.#offerWait) return;
+    this.#teardownUA();
+  }
+  /**
+   * A live leg is on the current UA: the call or a consult leg. An outbound call counts from the moment its INVITE
+   * is created — `#callWhenRegistered` wraps it there and then — so no failure in between can end it unseen.
+   */
+  #carriesCall() {
+    return this.#activeCall !== null || this.#consultCall !== null;
+  }
+  #buildTarget(target) {
+    return target.includes("@") ? target : `sip:${target}@${this.#domain}`;
+  }
+  #setState(state) {
+    if (state === this.#state) return;
+    this.#state = state;
+    for (const listener of [...this.#stateListeners]) listener(state);
+  }
+};
+
+// src/transports/sip/real-factory.ts
+var cached = null;
+async function loadJsSipFactory() {
+  if (cached) return cached;
+  const mod = await import('jssip');
+  const JsSIP = mod.default ?? mod;
+  if (!JsSIP?.UA || !JsSIP?.WebSocketInterface) {
+    throw new Error("jssip: unexpected module shape (no UA / WebSocketInterface)");
+  }
+  cached = {
+    createWebSocket: (wsUrl) => new JsSIP.WebSocketInterface(wsUrl),
+    createUA: (config) => new JsSIP.UA(config)
+  };
+  return cached;
+}
+
+// src/transports/providers/zadarma.ts
+var PING = { localMs: 3e4, globalMs: 6e4 };
+var KEY_REFRESH_BUFFER_MS = 2 * 60 * 60 * 1e3;
+var KEY_EXPIRY_MARGIN_MS = 6e4;
+var REKEY_DEBOUNCE_MS = 3e4;
+var REBUILD_CONNECT_TIMEOUT_MS = 1e4;
+var REBUILD_RETRY_MS = 3e4;
+var ZADARMA_QUIRKS = {
+  // Zadarma's registrar REFUSES to register a WebRTC client with any other User-Agent — a clean 401
+  // after a valid digest challenge, indistinguishable from a wrong password (§3.1). The old CRM
+  // hook carried this string; the port dropped it, and registration failed for exactly that reason.
+  userAgent: "Zadarma webRTC",
+  // Zadarma re-offers a declined call until its ring time ends (~30 s by default): the declined caller's offers
+  // are ignored while that call lives — this long after the decline when the backend cannot say (§3.4,
+  // incoming-call-reliability.md §4.4, Q1).
+  declinedCallerGuardMs: 35e3,
+  // The INVITE follows the REGISTER's 200 OK by ~0.1 s. Nothing 10 s after it: no call is coming to this UA.
+  noInviteAfterRegisterMs: 1e4,
+  // A leak guard only: an offer still waiting for its INVITE 2 min after its push is abandoned (§4.3).
+  offerWaitMaxMs: 12e4,
+  // Deprecated names of the two above, same values: this object is exported, and 0.5.1 is a patch. Never read.
+  rejectGuardMs: 35e3,
+  noInviteTeardownMs: 1e4,
+  // A ceiling on ICE gathering, not a target: JsSIP sends as soon as gathering completes. 3 s leaves
+  // room for a TURN allocation (whose relay candidates arrive last) while still bounding the ~40 s
+  // Chrome can spend against an unreachable server. See `capIceGathering`.
+  iceGatheringCapMs: 3e3
+};
+function buildPushUrl(key, sip) {
+  const params = new URLSearchParams({ key, integrationType: "site", sipId: sip });
+  return `wss://ws.zadarma.com/webrtc_pushes?${params.toString()}`;
+}
+function readPush(payload) {
+  let data = payload;
+  if (typeof data === "string") {
+    try {
+      data = JSON.parse(data);
+    } catch {
+      return { kind: "other", detail: "unreadable payload" };
+    }
+  }
+  if (!data || typeof data !== "object") return { kind: "other", detail: "no payload" };
+  const { action, callerid } = data;
+  let from = null;
+  if (typeof callerid === "string" && callerid) from = callerid;
+  else if (typeof callerid === "number") from = String(callerid);
+  if (action === "incoming") return { kind: "offer", from };
+  if (action === "answered") return { kind: "offer-ended", from };
+  return { kind: "other", detail: typeof action === "string" ? `action "${action}"` : "no action" };
+}
+function expiryOf(key) {
+  if (!key.keyExpiresAt) return null;
+  const at = new Date(key.keyExpiresAt).getTime();
+  return Number.isFinite(at) ? at : null;
+}
+var ZadarmaCredentials = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  #key = null;
+  #keyInFlight = null;
+  #sip = null;
+  #sipInFlight = null;
+  /**
+   * Bumped by `forget`, one per half: a fetch begun before it must not put back what was just forgotten — a
+   * refused credential that comes back from a slow request is still refused.
+   */
+  #keyGeneration = 0;
+  #sipGeneration = 0;
+  /**
+   * The SIP credentials were already refetched once because their WSS could not be reached: if the fresh ones
+   * cannot reach it either, the network is the problem, and asking Zadarma again would not change it. Re-armed by
+   * a registration that works (`worked`), and by forgetting everything (a refusal, a stop).
+   */
+  #unreachableRefetched = false;
+  /** What is in memory right now — both halves, for one key — or `null`. Never fetches. */
+  current() {
+    const key = this.#key?.value;
+    const sip = this.#sip;
+    return key && sip && sip.forKey === key.key ? { key, pass: sip.pass, domain: sip.domain } : null;
+  }
+  /** Their WSS could not be reached: forget the SIP half — once, until `worked()`. Whether it was forgotten. */
+  forgetUnreachable() {
+    if (this.#unreachableRefetched) return false;
+    this.forget("sip");
+    this.#unreachableRefetched = true;
+    return true;
+  }
+  /** A registration worked with what is in memory. */
+  worked() {
+    this.#unreachableRefetched = false;
+  }
+  /** The cached key while it is alive; otherwise a fresh one (and, in the background, its SIP credentials). */
+  key() {
+    const cached2 = this.#key;
+    if (cached2 && (cached2.expiresAt === null || Date.now() < cached2.expiresAt - KEY_EXPIRY_MARGIN_MS)) {
+      return Promise.resolve(cached2.value);
+    }
+    return this.#fetchKey();
+  }
+  /** A new key now, whatever is cached: the refresh ahead of expiry. The old one serves until this one lands. */
+  renew() {
+    return this.#fetchKey();
+  }
+  /** The key and the SIP credentials it bought, from memory when they are there. */
+  async sip() {
+    const key = await this.key();
+    const { pass, domain } = await this.#sipFor(key);
+    return { key, pass, domain };
+  }
+  /** Synchronous up to the request, so a prefetch and a `provision()` racing it share one exchange. */
+  #sipFor(key) {
+    const cached2 = this.#sip;
+    if (cached2 && cached2.forKey === key.key) return Promise.resolve({ pass: cached2.pass, domain: cached2.domain });
+    const inFlight = this.#sipInFlight;
+    if (inFlight && inFlight.forKey === key.key) return inFlight.promise;
+    const generation = this.#sipGeneration;
+    let request;
+    try {
+      request = this.deps.exchangeWebphoneData(key.key, key.sip);
+    } catch (cause) {
+      request = Promise.reject(cause instanceof Error ? cause : new Error(String(cause)));
+    }
+    const promise = request.then((data) => {
+      if (generation === this.#sipGeneration) this.#sip = { forKey: key.key, pass: data.pass, domain: data.domain };
+      return data;
+    });
+    const entry = { forKey: key.key, promise };
+    this.#sipInFlight = entry;
+    void promise.finally(() => {
+      if (this.#sipInFlight === entry) this.#sipInFlight = null;
+    }).catch(() => {
+    });
+    return promise;
+  }
+  /**
+   * Drop what stopped working. `all`: the registrar refused the credentials, so the key behind them may be the
+   * stale part too. `sip`: their WSS could not be reached — the key is fine, the datacenter may not be.
+   */
+  forget(what) {
+    this.#sipGeneration += 1;
+    this.#sip = null;
+    this.#sipInFlight = null;
+    if (what === "sip") return;
+    this.#keyGeneration += 1;
+    this.#key = null;
+    this.#keyInFlight = null;
+    this.#unreachableRefetched = false;
+  }
+  #fetchKey() {
+    if (this.#keyInFlight) return this.#keyInFlight;
+    const generation = this.#keyGeneration;
+    const inFlight = this.deps.fetchKey().then((value) => {
+      if (generation === this.#keyGeneration) {
+        this.#key = { value, expiresAt: expiryOf(value) };
+        void this.#sipFor(value).catch(() => {
+        });
+      }
+      return value;
+    });
+    this.#keyInFlight = inFlight;
+    void inFlight.finally(() => {
+      if (this.#keyInFlight === inFlight) this.#keyInFlight = null;
+    }).catch(() => {
+    });
+    return inFlight;
+  }
+};
+var ZadarmaPushSignal = class {
+  /**
+   * `credentials` is shared with the provider's `provision()`: one key for the push socket and the SIP
+   * credentials, fetched once (§4.5). A signal on its own gets a cache of its own.
+   */
+  constructor(deps, credentials = new ZadarmaCredentials(deps)) {
+    this.deps = deps;
+    this.credentials = credentials;
+  }
+  deps;
+  credentials;
+  #socket = null;
+  #connected = false;
+  #pingTimers = [];
+  #refreshTimer;
+  /** The replacement socket of a rebuild in flight, not yet current. */
+  #candidate = null;
+  /** Abandons the rebuild in flight (closing its candidate). */
+  #abortRebuild = null;
+  #rebuilding = false;
+  #retryTimer;
+  #unwatchBackground;
+  #closed = false;
+  /**
+   * Bumped by `disconnect()`. An open or a rebuild still awaiting its key when the signal is disconnected
+   * must build nothing afterwards — and `#closed` alone cannot say so once a later `connect()` (stop, then
+   * start again) has reset it: the late socket was built beside the new one, and nothing ever closed it.
+   */
+  #run = 0;
+  /**
+   * The key is due for its refresh (`#armRefresh`): the next rebuild fetches a new one instead of reusing the
+   * cached one — and keeps trying, on every retry and every hidden-tab tick, until one arrives.
+   */
+  #renewDue = false;
+  /** A rebuild asked for (`rekey`) while another was in flight: it runs once that one ends. */
+  #rekeyQueued = false;
+  #rekeyAfter = 0;
+  #listeners = /* @__PURE__ */ new Set();
+  #connectionListeners = /* @__PURE__ */ new Set();
+  async connect() {
+    if (this.#socket) return;
+    this.#closed = false;
+    this.#unwatchBackground ??= this.deps.watchBackgroundReconnect?.(() => void this.#reopen());
+    await this.#open();
+  }
+  /**
+   * The registrar refused credentials bought with this socket's key, and the provider has forgotten them: the
+   * socket is rebuilt on a fresh key, make-before-break like every rebuild (`#reopen`).
+   *
+   * Debounced: a registrar refusing every attempt must not become a tight loop against our backend and
+   * Zadarma's. This rebuild used to be the engine's (`#refreshSignal`, a close-then-open); it lives here now
+   * because only the provider knows the push socket and the SIP credentials share one key.
+   */
+  rekey() {
+    if (this.#closed || !this.#socket) return;
+    const now = Date.now();
+    if (now < this.#rekeyAfter) return;
+    this.#rekeyAfter = now + REKEY_DEBOUNCE_MS;
+    if (this.#rebuilding) this.#rekeyQueued = true;
+    else void this.#reopen();
+  }
+  async #open() {
+    const run = this.#run;
+    const { key, sip, keyExpiresAt } = await this.credentials.key();
+    if (run !== this.#run) return;
+    const socket = this.deps.createPushSocket(buildPushUrl(key, sip));
+    this.#socket = socket;
+    this.#attach(socket);
+    this.#armRefresh(keyExpiresAt);
+  }
+  /**
+   * Wires one socket's events. `this.#socket` is read when an event FIRES, not when it is wired: a socket that
+   * has been replaced must stop driving connectivity (our own `close()` of it emits `disconnect`, which would
+   * otherwise flip the state to offline right after a perfectly healthy swap). `update` is the exception — it is
+   * forwarded from any socket not yet closed, because a push seen twice is harmless (the engine ignores an offer
+   * mid-call, and a second one only sends one more REGISTER) while one seen by neither is a missed call.
+   *
+   * With `hooks`, the socket is a rebuild's candidate: its first `connect` or failure goes to the rebuild instead
+   * of changing the connection state (it is not current yet).
+   */
+  #attach(socket, hooks) {
+    socket.on("connect", () => {
+      if (hooks && socket === this.#candidate) return hooks.onConnect();
+      if (socket !== this.#socket) return;
+      this.#setConnected(true);
+      this.#startPings(socket);
+    });
+    socket.on("update", (payload) => this.#emit(readPush(payload)));
+    const lost = () => {
+      if (hooks && socket === this.#candidate) return hooks.onFailure();
+      if (socket !== this.#socket) return;
+      this.#stopPings();
+      this.#setConnected(false);
+    };
+    socket.on("disconnect", lost);
+    socket.on("connect_error", lost);
+  }
+  /**
+   * Presence pings — **the reason an idle tab keeps receiving calls**.
+   *
+   * Zadarma's gateway decides whether the extension is online, and it decides from these. Without
+   * them the socket goes quiet, Zadarma marks the extension offline within minutes, and INVITEs stop
+   * being routed — with no error anywhere, because nothing failed. The only visible symptom is that
+   * the phone silently stops ringing until the page is reloaded.
+   *
+   * The names and intervals are Zadarma's, taken from the CRM hook that ran this in production for
+   * years. They are not ours to tune.
+   */
+  #startPings(socket) {
+    this.#stopPings();
+    this.#pingTimers = [
+      setInterval(() => socket.emit("localPing", {}), PING.localMs),
+      setInterval(() => socket.emit("globalPing", {}), PING.globalMs)
+    ];
+  }
+  #stopPings() {
+    for (const t of this.#pingTimers) clearInterval(t);
+    this.#pingTimers = [];
+  }
+  /**
+   * Rebuild the socket before the WebRTC key expires.
+   *
+   * The key is baked into the socket URL, so socket.io's own reconnection re-presents whatever it was
+   * given at construction. A tab left open past the key's 72 h lifetime would reconnect forever with
+   * a dead credential. Absolute, from the backend's `key_expires_at`, so it targets the real expiry
+   * rather than restarting a countdown on every reconnect.
+   *
+   * It is also the refresh of the shared credentials (incoming-call-reliability.md §4.5): the new key replaces
+   * the cached one, and its SIP credentials are fetched with it, in the background — no call waits for either.
+   */
+  #armRefresh(keyExpiresAt) {
+    clearTimeout(this.#refreshTimer);
+    if (!keyExpiresAt) return;
+    const ms = new Date(keyExpiresAt).getTime() - Date.now() - KEY_REFRESH_BUFFER_MS;
+    if (!Number.isFinite(ms) || ms <= 0) return;
+    this.#refreshTimer = setTimeout(() => {
+      this.#renewDue = true;
+      void this.#reopen();
+    }, ms);
+  }
+  /**
+   * Replaces the push socket with a fresh one — MAKE-BEFORE-BREAK (presence-client-reporting.md §4.1, T8).
+   *
+   * Why it must happen at all: Zadarma's gateway decides the extension is alive from the raw Engine.IO ping, which
+   * a hidden tab's throttled timers silently stop sending, so while the tab is hidden the socket is rebuilt every
+   * 20 s (`push-socket-reliability.md` §5.3), and once before the key expires. Why it must not leave a gap: the
+   * old close-then-reopen reported `connected = false` for the ~0.5 s in between, which took the softphone
+   * `offline`, tore down the presence socket and left Zadarma with no socket to push an incoming call to.
+   *
+   * Now the OLD socket stays up and stays current until the NEW one has actually connected; only then do we swap,
+   * move the pings and close the old one. A healthy rebuild never changes `connected`. A failed one — the key fetch
+   * throws, the socket errors, or it has not connected within `REBUILD_CONNECT_TIMEOUT_MS` — keeps the old socket
+   * and retries, instead of leaving the tab disconnected. Zadarma does not evict the older of two sockets for one
+   * sip (multi-tab-leader-election.md §1), so the overlap is safe.
+   *
+   * The key comes from the shared cache — a hidden-tab tick makes no request — unless it is due for its refresh
+   * (`#renewDue`) or has been forgotten after a refused registration (`rekey`).
+   */
+  async #reopen() {
+    if (this.#closed || this.#rebuilding) return;
+    if (!this.#socket) {
+      try {
+        await this.#open();
+      } catch {
+      }
+      return;
+    }
+    this.#rebuilding = true;
+    const run = this.#run;
+    try {
+      const { key, sip, keyExpiresAt } = await (this.#renewDue ? this.credentials.renew() : this.credentials.key());
+      if (run !== this.#run) return;
+      this.#renewDue = false;
+      const swapped = await new Promise((resolve) => {
+        const socket = this.deps.createPushSocket(buildPushUrl(key, sip));
+        this.#candidate = socket;
+        let settled = false;
+        const finish = (ok) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          this.#abortRebuild = null;
+          if (ok && socket.connected) {
+            this.#swapIn(socket, keyExpiresAt);
+          } else {
+            this.#candidate = null;
+            socket.close();
+          }
+          resolve(ok && socket.connected);
+        };
+        const timer = setTimeout(() => finish(false), REBUILD_CONNECT_TIMEOUT_MS);
+        this.#abortRebuild = () => finish(false);
+        this.#attach(socket, { onConnect: () => finish(true), onFailure: () => finish(false) });
+      });
+      if (!swapped) this.#armRetry();
+    } catch {
+      this.#armRetry();
+    } finally {
+      this.#rebuilding = false;
+    }
+    if (this.#rekeyQueued) {
+      this.#rekeyQueued = false;
+      void this.#reopen();
+    }
+  }
+  /**
+   * The moment of the swap — synchronous, called from the candidate's own `connect` event so nothing can run
+   * between "the new socket is up" and "it is the current one". Order matters: `#socket` moves first, so the old
+   * socket's `disconnect` (our own `close()` of it, just below) is ignored by `#attach`.
+   */
+  #swapIn(socket, keyExpiresAt) {
+    const previous = this.#socket;
+    this.#socket = socket;
+    this.#candidate = null;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = void 0;
+    this.#stopPings();
+    this.#startPings(socket);
+    this.#setConnected(true);
+    previous?.close();
+    this.#armRefresh(keyExpiresAt);
+  }
+  #armRetry() {
+    if (this.#closed) return;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = setTimeout(() => void this.#reopen(), REBUILD_RETRY_MS);
+  }
+  /**
+   * Closes everything — and forgets the credentials: this is how the engine stops, and a phone that is off holds
+   * no SIP password. The next `connect()` fetches them again.
+   */
+  disconnect() {
+    this.#closed = true;
+    this.#run += 1;
+    this.#renewDue = false;
+    this.#rekeyQueued = false;
+    this.#rekeyAfter = 0;
+    this.credentials.forget("all");
+    this.#stopPings();
+    clearTimeout(this.#refreshTimer);
+    this.#refreshTimer = void 0;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = void 0;
+    this.#abortRebuild?.();
+    this.#unwatchBackground?.();
+    this.#unwatchBackground = void 0;
+    this.#socket?.close();
+    this.#socket = null;
+    this.#setConnected(false);
+  }
+  onSignal(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  onConnectionChange(listener) {
+    this.#connectionListeners.add(listener);
+    return () => this.#connectionListeners.delete(listener);
+  }
+  get connected() {
+    return this.#connected;
+  }
+  #setConnected(connected) {
+    if (this.#connected === connected) return;
+    this.#connected = connected;
+    for (const listener of [...this.#connectionListeners]) listener(connected);
+  }
+  #emit(event) {
+    for (const listener of [...this.#listeners]) listener(event);
+  }
+};
+var ZadarmaProvider = class {
+  name = "zadarma";
+  // Zadarma's PBX ignores a standing registration — it routes INVITEs only to a UA that registered
+  // in response to a push (SPEC §3.2). Hence on-demand.
+  registrationMode = "on-demand";
+  quirks = ZADARMA_QUIRKS;
+  incomingSignal;
+  /**
+   * One key and one set of SIP credentials for the push socket and every registration (§4.5). Its "unreachable
+   * refetched once" mark lives there too, so a stop — which forgets the credentials — clears it as well.
+   */
+  #credentials;
+  #signal;
+  constructor(deps) {
+    this.#credentials = new ZadarmaCredentials(deps);
+    this.#signal = new ZadarmaPushSignal(deps, this.#credentials);
+    this.incomingSignal = this.#signal;
+  }
+  /**
+   * The SIP credentials, from memory (incoming-call-reliability.md §4.5). They were fetched when the push socket
+   * opened — the key from our backend, then `{ pass, domain }` from Zadarma, in the browser for the geo-routing
+   * (SPEC §3.1) — so a push goes straight to the WSS and the REGISTER. Fetched here only when they are not there:
+   * the background fetch failed, or they were forgotten (`credentialsFailed`).
+   */
+  async provision() {
+    return toSipCredentials(await this.#credentials.sip());
+  }
+  /**
+   * `rejected` (401/403): the key may be the stale part, so both are forgotten, and the push socket — which
+   * holds the same key — is rebuilt on a fresh one. `unreachable`: only the SIP credentials, and only once
+   * until a registration works: Zadarma may have moved this browser to another datacenter (SPEC §3.1).
+   *
+   * Only if `credentials` — the ones that failed — are still what is in memory: a UA let go of earlier can report
+   * late, when the cache has already moved on to fresh ones, and those must not be thrown away for it.
+   */
+  credentialsFailed(reason, credentials) {
+    if (credentials && !this.#holds(credentials)) return true;
+    if (reason === "rejected") {
+      this.#credentials.forget("all");
+      this.#signal.rekey();
+      return true;
+    }
+    return this.#credentials.forgetUnreachable();
+  }
+  credentialsWorked() {
+    this.#credentials.worked();
+  }
+  #holds(credentials) {
+    const current = this.#credentials.current();
+    if (!current) return false;
+    const held = toSipCredentials(current);
+    return held.uri === credentials.uri && held.authUser === credentials.authUser && held.password === credentials.password;
+  }
+};
+function toSipCredentials({ key, pass, domain }) {
+  return {
+    uri: `sip:${key.sip}@${domain}`,
+    authUser: key.sip,
+    password: pass,
+    wsUrl: `wss://${domain}:4443`
+  };
+}
+
+// src/transports/providers/zadarma-browser.ts
+var UnauthorizedKeyError = class extends Error {
+};
+var KeyFetchError = class extends Error {
+  constructor(message, status, retryAfterMs) {
+    super(message);
+    this.status = status;
+    this.retryAfterMs = retryAfterMs;
+  }
+  status;
+  retryAfterMs;
+};
+function retryAfterMsOf(res) {
+  const value = res.headers?.get?.("retry-after");
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const at = Date.parse(value);
+  return Number.isFinite(at) ? Math.max(0, at - Date.now()) : void 0;
+}
+function makeFetchKey(config) {
+  const attempt = async () => {
+    let token;
+    try {
+      ({ token } = await config.tokenSource.getToken());
+    } catch (cause) {
+      throw createError("auth/token-fetch-failed", cause);
+    }
+    const qs = config.organizationId ? `?organization_id=${encodeURIComponent(config.organizationId)}` : "";
+    const res = await fetch(`${config.apiBase}/phone/webrtc/key${qs}`, {
+      headers: { Authorization: token }
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => null);
+      const message = body?.message ?? `webrtc/key HTTP ${res.status}`;
+      throw res.status === 401 ? new UnauthorizedKeyError(message) : new KeyFetchError(message, res.status, retryAfterMsOf(res));
+    }
+    const data = await res.json();
+    return {
+      key: data.key,
+      sip: data.sip,
+      ...data.key_expires_at ? { keyExpiresAt: data.key_expires_at } : {}
+    };
+  };
+  return async () => {
+    try {
+      return await attempt();
+    } catch (error) {
+      if (!(error instanceof UnauthorizedKeyError)) throw error;
+      invalidateToken(config.tokenSource);
+      try {
+        return await attempt();
+      } catch (retryError) {
+        if (retryError instanceof UnauthorizedKeyError) {
+          throw createError("auth/token-rejected", retryError);
+        }
+        throw retryError;
+      }
+    }
+  };
+}
+async function exchangeWebphoneData(key, sip, timeoutMs = 1e4) {
+  const params = new URLSearchParams({
+    // Still sent: the endpoint wraps its response either way, and naming the callback keeps the
+    // wrapper predictable rather than relying on their default.
+    jsonpCallback: "cv",
+    integrationType: "site",
+    key,
+    sipId: sip
+  });
+  let res;
+  try {
+    res = await fetch(
+      `https://api.zadarma.com/sys/webrtc/get_webphone_data.php?${params.toString()}`,
+      { signal: AbortSignal.timeout(timeoutMs) }
+    );
+  } catch (cause) {
+    const timedOut = cause instanceof DOMException && cause.name === "TimeoutError";
+    throw new Error(timedOut ? "get_webphone_data timed out" : "get_webphone_data network error", {
+      cause
+    });
+  }
+  if (!res.ok) throw new Error(`get_webphone_data HTTP ${res.status}`);
+  const data = parseJsonp(await res.text());
+  if (!data || data.error || !data.pass || !data.domain) {
+    throw new Error(data?.error?.content ?? "get_webphone_data: missing SIP credentials");
+  }
+  return { pass: data.pass, domain: data.domain };
+}
+function parseJsonp(text) {
+  const open = text.indexOf("(");
+  const close = text.lastIndexOf(")");
+  const body = open !== -1 && close > open ? text.slice(open + 1, close) : text;
+  try {
+    return JSON.parse(body);
+  } catch {
+    return null;
+  }
+}
+function createPushSocket(url) {
+  const handlers = /* @__PURE__ */ new Map();
+  let client = null;
+  let closed = false;
+  void (async () => {
+    const mod = await import('socket.io-client-v2');
+    if (closed) return;
+    const connect = mod.default ?? mod.io;
+    if (!connect) throw new Error("socket.io-client-v2: no connect export");
+    const c = connect(url, {
+      transports: ["websocket"],
+      reconnection: true,
+      // The push socket drops on a schedule under background-tab timer throttling, NOT from network
+      // flakiness — every reconnect observed succeeds on the first attempt (push-socket-reliability.md
+      // §2.3, §5.1). There is nothing to back off from on that first attempt, so waiting the old 10s
+      // before retrying was pure, uncontested exposure — an inbound call landing in that window is
+      // lost, unqueued (Zadarma's gateway speaks EIO3, no offline redelivery). `reconnectionDelayMax`
+      // stays as the ceiling for a genuinely down gateway, where backing off still matters.
+      reconnectionDelay: 300,
+      reconnectionDelayMax: 3e4
+    });
+    client = c;
+    for (const [event, cbs] of handlers) for (const cb of cbs) c.on(event, cb);
+  })();
+  return {
+    on(event, cb) {
+      const list = handlers.get(event) ?? [];
+      list.push(cb);
+      handlers.set(event, list);
+      client?.on(event, cb);
+    },
+    emit(event, payload) {
+      client?.emit(event, payload);
+    },
+    close() {
+      closed = true;
+      client?.close();
+    },
+    get connected() {
+      return client?.connected ?? false;
+    }
+  };
+}
+var BACKGROUND_RECONNECT_MS = 2e4;
+var HEARTBEAT_WORKER_SOURCE = `
+  let timer;
+  self.onmessage = (e) => {
+    if (e.data.type === 'start') timer = setInterval(() => self.postMessage('tick'), e.data.intervalMs);
+    else if (e.data.type === 'stop') { clearInterval(timer); timer = undefined; }
+  };
+`;
+function watchBackgroundReconnect(cb) {
+  if (typeof document === "undefined" || typeof Worker === "undefined") return () => {
+  };
+  let worker = null;
+  let blobUrl = null;
+  const ensureWorker = () => {
+    if (!worker) {
+      blobUrl = URL.createObjectURL(new Blob([HEARTBEAT_WORKER_SOURCE], { type: "application/javascript" }));
+      worker = new Worker(blobUrl);
+      worker.onmessage = (e) => {
+        if (e.data === "tick") cb();
+      };
+    }
+    return worker;
+  };
+  const onVisibilityChange = () => {
+    if (document.visibilityState === "hidden") {
+      ensureWorker().postMessage({ type: "start", intervalMs: BACKGROUND_RECONNECT_MS });
+    } else {
+      worker?.postMessage({ type: "stop" });
+    }
+  };
+  document.addEventListener("visibilitychange", onVisibilityChange);
+  if (document.visibilityState === "hidden") onVisibilityChange();
+  return () => {
+    document.removeEventListener("visibilitychange", onVisibilityChange);
+    worker?.postMessage({ type: "stop" });
+    worker?.terminate();
+    if (blobUrl) URL.revokeObjectURL(blobUrl);
+  };
+}
+function makeZadarmaBrowserDeps(config) {
+  return {
+    fetchKey: makeFetchKey(config),
+    exchangeWebphoneData: (key, sip) => exchangeWebphoneData(key, sip),
+    createPushSocket,
+    watchBackgroundReconnect
+  };
+}
+
+// src/transports/zadarma-engine.ts
+function createZadarmaEngine(config) {
+  const provider = new ZadarmaProvider(
+    makeZadarmaBrowserDeps({
+      ...config,
+      apiBase: normalizeApiBase(config.apiBase),
+      tokenSource: cachedTokenSource(config.tokenSource)
+    })
+  );
+  return new SipCallEngine(provider, loadJsSipFactory);
+}
+
+export { ZADARMA_QUIRKS, createZadarmaEngine };
+//# sourceMappingURL=chunk-3UTUWGVG.js.map
+//# sourceMappingURL=chunk-3UTUWGVG.js.map